phaa Casino – Privacy Policy

1. Overview and Scope

This Privacy Policy ("Policy") describes how phaa Casino ("phaa," "we," "us," or "our") collects, uses, stores, shares, and protects the personal information of individuals ("you," "User," or "Player") who access or use the phaa Casino website, mobile platform, games, and all related services (collectively, the "phaa Platform").

This Policy applies to all personal data processed by phaa in connection with your use of the phaa Platform, regardless of whether you are a registered player, a visitor browsing the site, or a person who contacts phaa's customer support team. By using the phaa Platform, you acknowledge that you have read and understood this Policy.

This Policy should be read together with phaa's Terms & Conditions and Responsible Gaming Policy.

2. Data Controller Information

phaa Casino is the personal information controller responsible for the personal data collected through the phaa Platform. As the controller, phaa determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with the Data Privacy Act of 2012 and all applicable Philippine privacy regulations.

phaa has appointed a Data Protection Officer (DPO) who is responsible for overseeing data protection strategy and implementation. You may contact the DPO directly for any privacy-related concerns — see Section 14 for contact details.

3. Personal Data We Collect

phaa collects the following categories of personal data, depending on how you interact with the phaa Platform:

Category	Examples	When Collected
Identity Data	Full name, date of birth, nationality, government-issued ID number	Registration & KYC verification
Contact Data	Email address, mobile number, residential address	Registration & account updates
Financial Data	GCash number, bank account details, transaction history, deposit and withdrawal records	Deposits, withdrawals & KYC
Gaming Data	Game history, bet amounts, win/loss records, session duration, bonus usage	During gameplay
Technical Data	IP address, device type, browser type, operating system, login timestamps	Automatically on site access
Communications Data	Support chat transcripts, email correspondence, feedback submissions	When you contact phaa
Verification Documents	Scanned copies of government-issued IDs, proof of address, selfie photos for liveness checks	KYC verification process

phaa does not collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. We do not collect information about your religious beliefs, political opinions, or health status unless you voluntarily provide such information in a support context.

4. How We Collect Your Data

phaa collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in promotions.
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies when you access the phaa Platform. See Section 10 for details on cookies.
• From third parties — including identity verification service providers, payment processors (such as GCash and Maya), fraud detection services, and PAGCOR's regulatory systems where required by law.
• From publicly available sources — such as government databases used for sanctions screening and anti-money laundering checks, as required under the Philippine AMLA.

5. Purposes of Processing

phaa processes your personal data for the following specific, legitimate purposes:

• Account creation and management — to register your phaa account, verify your identity, and maintain your account in good standing.
• Service delivery — to provide access to phaa Casino games, process deposits and withdrawals, and deliver customer support.
• Regulatory compliance — to comply with PAGCOR licensing requirements, the Anti-Money Laundering Act (AMLA), the Data Privacy Act of 2012, and other applicable Philippine laws.
• Fraud prevention and security — to detect, investigate, and prevent fraudulent activity, cheating, money laundering, and unauthorized account access.
• Responsible gaming — to monitor gaming behavior, enforce self-exclusion requests, and identify players who may need responsible gaming support.
• Marketing and promotions — to send you relevant bonus offers, game updates, and promotional communications, where you have provided consent or where permitted by law. You may opt out at any time.
• Platform improvement — to analyze usage patterns, improve game performance, and enhance the overall phaa user experience.
• Legal proceedings — to establish, exercise, or defend legal claims involving phaa.

6. Legal Basis for Processing

Under the Data Privacy Act of 2012, phaa processes your personal data on the following legal bases:

• Contractual necessity — processing required to perform the contract between you and phaa (i.e., providing the gaming services you have registered for).
• Legal obligation — processing required to comply with PAGCOR regulations, AMLA obligations, NPC requirements, and other applicable Philippine laws.
• Legitimate interests — processing for fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your privacy rights.
• Consent — processing for marketing communications and non-essential cookies, where you have given explicit, informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing and Disclosure

phaa does not sell your personal data to third parties. phaa may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment processors — GCash, Maya, and partner banks (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) for the purpose of processing deposits and withdrawals.
• Identity verification providers — third-party KYC and liveness-check service providers engaged to verify player identities in compliance with PAGCOR requirements.
• Game software providers — licensed game developers whose games are hosted on the phaa Platform, to the extent necessary for game delivery and fairness auditing.
• Regulatory authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies, where required by law or regulatory directive.
• Law enforcement — Philippine law enforcement agencies, where phaa is legally required to disclose information in connection with a criminal investigation or court order.
• Professional advisers — lawyers, auditors, and accountants engaged by phaa, subject to professional confidentiality obligations.

All third-party service providers engaged by phaa are required to process personal data only in accordance with phaa's instructions and applicable Philippine data protection law.

8. Data Retention

phaa retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

• Account and identity data — retained for the duration of your account and for a minimum of 5 years after account closure, in compliance with PAGCOR and AMLA requirements.
• Financial transaction records — retained for a minimum of 5 years from the date of the transaction, as required under the Anti-Money Laundering Act.
• Gaming history — retained for 3 years from the date of each gaming session, or longer if required for dispute resolution or regulatory purposes.
• Customer support communications — retained for 2 years from the date of the last interaction, unless a longer period is required for ongoing dispute resolution.
• Marketing consent records — retained for the duration of your consent and for 1 year after withdrawal, to demonstrate compliance.
• Technical and log data — retained for 12 months from collection, unless required for longer periods for security investigations.

Upon expiry of the applicable retention period, phaa will securely delete or anonymize your personal data in accordance with NPC-approved disposal procedures.

9. Security Measures

phaa implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phaa Platform.
• Encryption at rest for all sensitive personal and financial data stored on phaa's servers.
• Multi-factor authentication (MFA) options for player accounts to prevent unauthorized access.
• Role-based access controls ensuring that phaa staff can only access personal data necessary for their specific job functions.
• Regular security audits and penetration testing conducted by independent cybersecurity professionals.
• Intrusion detection and monitoring systems operating 24/7 to identify and respond to security threats.
• Staff training on data privacy obligations under the Data Privacy Act of 2012 and phaa's internal data handling policies.

In the event of a personal data breach that is likely to result in harm to affected individuals, phaa will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with NPC Circular No. 16-03.

10. Cookies and Tracking Technologies

The phaa Platform uses cookies and similar tracking technologies to enhance your experience, maintain session security, and analyze platform usage. The following categories of cookies are used:

• Strictly necessary cookies — essential for the phaa Platform to function, including session management, login authentication, and security tokens. These cannot be disabled.
• Functional cookies — remember your preferences such as language settings, game display options, and responsible gaming limits you have set.
• Analytics cookies — collect anonymized data about how players use the phaa Platform to help us improve performance and user experience. Used only with your consent.
• Marketing cookies — used to deliver relevant promotional content and measure the effectiveness of phaa's marketing campaigns. Used only with your explicit consent.

You may manage your cookie preferences through the cookie consent banner displayed on your first visit to the phaa Platform, or through your browser settings. Please note that disabling certain cookies may affect the functionality of the phaa Platform.

11. Your Data Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phaa. To exercise any of these rights, please contact phaa's Data Protection Officer using the details in Section 14.

12. Minors and Age Restriction

The phaa Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine gambling regulations. phaa does not knowingly collect personal data from persons under 21 years of age. If phaa becomes aware that personal data has been collected from a person under 21, that account will be immediately closed, all data will be deleted, and any funds will be handled in accordance with PAGCOR's requirements for underage account closures.

If you believe that a minor has registered on the phaa Platform, please contact our support team immediately at [email protected].

13. Changes to This Privacy Policy

phaa reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, phaa will notify registered players via email or an in-platform notification at least 7 days before the changes take effect. The "Last updated" date at the top of this Policy will always reflect the most recent revision. Your continued use of the phaa Platform after the effective date of any update constitutes your acceptance of the revised Policy.

14. Contact Us and Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or your personal data rights, please contact phaa's Data Protection Officer:

• Email: [email protected]
• General Support: [email protected]
• Live Chat: Available 24/7 via the phaa Platform
• Response Time: phaa aims to respond to all data privacy requests within 15 business days, as required by the Data Privacy Act of 2012.

If you are not satisfied with phaa's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy was last reviewed and updated in May 2026. phaa Casino reserves all rights not expressly granted herein.